From 55d7f7dc020fe18e7069bbcc6c6620078d208d76 Mon Sep 17 00:00:00 2001
From: Kess Plasmeier <kessplas@amazon.com>
Date: Wed, 4 Feb 2026 15:44:31 -0800
Subject: [PATCH 1/3] chore(release): release from main-3.x and remove javadocs

---
 codebuild/release/artifact-hunt.yml    |  2 +-
 codebuild/release/javadoc.yml          | 26 --------------------------
 codebuild/release/release-prod.yml     |  2 +-
 codebuild/release/release.yml          | 10 ----------
 codebuild/release/upload_artifacts.yml |  2 +-
 codebuild/release/version.yml          |  4 ++--
 6 files changed, 5 insertions(+), 41 deletions(-)
 delete mode 100644 codebuild/release/javadoc.yml

diff --git a/codebuild/release/artifact-hunt.yml b/codebuild/release/artifact-hunt.yml
index 1fea3e11e..c871708e5 100644
--- a/codebuild/release/artifact-hunt.yml
+++ b/codebuild/release/artifact-hunt.yml
@@ -5,7 +5,7 @@ version: 0.2
 
 env:
   variables:
-    BRANCH: "main"
+    BRANCH: "main-3.x"
 
 phases:
   install:
diff --git a/codebuild/release/javadoc.yml b/codebuild/release/javadoc.yml
deleted file mode 100644
index 8e0fa0e4d..000000000
--- a/codebuild/release/javadoc.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-## Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
-## SPDX-License-Identifier: Apache-2.0
-
-version: 0.2
-
-env:
-  variables:
-    BRANCH: "main"
-    GH_PAGES: "gh-pages"
-  git-credential-helper: yes
-
-phases:
-  pre_build:
-    commands:
-      - git config --global user.name "aws-crypto-tools-ci-bot"
-      - git config --global user.email "no-reply@noemail.local"
-      - git checkout $BRANCH
-  build:
-    commands:
-      - mvn javadoc:javadoc
-      - cp -r ./target/reports/apidocs /tmp
-      - git checkout $GH_PAGES
-      - cp -r /tmp/apidocs/* .
-      - git add .
-      - 'git commit -m "docs: updating javadocs"'
-      - git push -u origin $GH_PAGES
diff --git a/codebuild/release/release-prod.yml b/codebuild/release/release-prod.yml
index c833ca19a..1384e4a6b 100644
--- a/codebuild/release/release-prod.yml
+++ b/codebuild/release/release-prod.yml
@@ -6,7 +6,7 @@ version: 0.2
 
 env:
   variables:
-    BRANCH: "main"
+    BRANCH: "main-3.x"
   secrets-manager:
     GPG_KEY: Maven-GPG-Keys-Release-Credentials:Keyname
     GPG_PASS: Maven-GPG-Keys-Release-Credentials:Passphrase
diff --git a/codebuild/release/release.yml b/codebuild/release/release.yml
index e4042b4ed..aac7be825 100644
--- a/codebuild/release/release.yml
+++ b/codebuild/release/release.yml
@@ -84,13 +84,3 @@ batch:
       # standard:6.0 (Ubuntu) supports GH CLI; AL2 does not
       image: aws/codebuild/standard:6.0
 
-  # Generate and update new javadocs
-  - identifier: update_javadoc
-    depend-on:
-      - upload_artifacts
-    buildspec: codebuild/release/javadoc.yml
-    env:
-      variables:
-        JAVA_ENV_VERSION: corretto11
-        JAVA_NUMERIC_VERSION: 11
-      image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
diff --git a/codebuild/release/upload_artifacts.yml b/codebuild/release/upload_artifacts.yml
index 95515f0f7..b69b45cfa 100644
--- a/codebuild/release/upload_artifacts.yml
+++ b/codebuild/release/upload_artifacts.yml
@@ -5,7 +5,7 @@ version: 0.2
 
 env:
   variables:
-    BRANCH: "main"
+    BRANCH: "main-3.x"
   git-credential-helper: yes
   parameter-store:
     ACCOUNT: /CodeBuild/AccountId
diff --git a/codebuild/release/version.yml b/codebuild/release/version.yml
index ad18db28e..f7f25e457 100644
--- a/codebuild/release/version.yml
+++ b/codebuild/release/version.yml
@@ -6,7 +6,7 @@ version: 0.2
 env:
   variables:
     NODE_OPTIONS: "--max-old-space-size=4096"
-    BRANCH: "main"
+    BRANCH: "main-3.x"
   git-credential-helper: "yes"
   secrets-manager:
     GH_TOKEN: Github/aws-crypto-tools-ci-bot:ESDK Release Token
@@ -31,4 +31,4 @@ phases:
   build:
     commands:
       # semantic-release uses config stored in ~/.releaserc
-      - npx semantic-release --branches $BRANCH --no-ci
\ No newline at end of file
+      - npx semantic-release --branches $BRANCH --no-ci

From 06c7bc3703b634cb93547a5c0a4f4b7a49b21736 Mon Sep 17 00:00:00 2001
From: Kess Plasmeier <kessplas@amazon.com>
Date: Wed, 4 Feb 2026 16:04:39 -0800
Subject: [PATCH 2/3] fix static analysis permissions

---
 .github/workflows/static-analysis.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 4ee343f00..5163f3097 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -7,7 +7,6 @@ jobs:
   SpotBugs:
     runs-on: ubuntu-latest
     permissions:
-      id-token: write
       contents: read
 
     steps:

From 322951e312e344ba41278e1636608f3a324a548a Mon Sep 17 00:00:00 2001
From: Kess Plasmeier <kessplas@amazon.com>
Date: Wed, 4 Feb 2026 16:12:56 -0800
Subject: [PATCH 3/3] fix permissions

---
 .github/workflows/ci-workflow.yml     | 4 ++++
 .github/workflows/static-analysis.yml | 1 +
 2 files changed, 5 insertions(+)

diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml
index 19e1726d1..b78c8e6fb 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/ci-workflow.yml
@@ -1,5 +1,9 @@
 name: Continuous Integration Workflow
 
+permissions:
+  contents: read
+  id-token: write
+
 on:
   pull_request:
   push:
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 5163f3097..4ee343f00 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -7,6 +7,7 @@ jobs:
   SpotBugs:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: read
 
     steps: